# DF-0886 — autofs_node_vn create race

**Bug:** `autofs_node_vn()` (`sys/vfs/autofs/autofs_vnops.c:564-602`)
drops `an_vnode_lock` (line 589) before sleeping in `getnewvnode()`
(line 591) and assigns `anp->an_vnode = vp` (line 598) without re-taking
the lock.  The KASSERT at line 597 catches the create race; with
INVARIANTS (default GENERIC) the kernel panics.

**Impact:** Medium — local kernel DoS (panic) on any autofs-configured
box.  Any unprivileged user can trigger via `stat()`/`ls` under the
mountpoint.  No escalation path (vnode-pointer-to-vnode-pointer overwrite,
no attacker-controlled content).

## Reproduce

### Prerequisites (root, once)
```sh
kldload autofs
mkdir -p /autofs_test
mount_autofs -f autofs_race "" /autofs_test
```

### Build
```sh
./build.sh     # builds stress_autofs_race + df0886_race.ko
```

### Run (deterministic harness)
```sh
./run.sh       # kldload df0886_race.ko
# UNPATCHED: panic "lost race" in autofs_node_vn
# FIXED:     all 4 racers complete, no panic
```

Racer output goes to the serial console (`/var/run/dmesg.boot` or
`dmesg`).

### Run (userspace stress, probabilistic)
```sh
./stress_autofs_race /autofs_test 16 30
# May panic under vnode pressure; window is ~us otherwise.
```

## Fix

See `fix.diff` — hold `an_vnode_lock` across `getnewvnode()` (mtx_t is a
sleeping mutex in DragonFly, so this is safe).